5 ms·
I'd love to know how many hours were needed to develop this exploit from start to finish, and how many dead ends the researcher ran into along the way. Just wr
by js2 9y ago
I'd love to know how many hours were needed to develop this exploit from start to finish, and how many dead ends the researcher ran into along the way.
Just writing the blog post and generating all the images for it must've taken many days.
- xtacy 9y agoFrom the project-zero bug (https://bugs.chromium.org/p/project-zero/issues/detail?id=1317#c3 https://bugs.chromium.org/p/project-zero/issues/detail?id=13...), it looks like the first discussion on the issue dates back to July 3, with a working exploit posted just yesterday.
- tr1ck5t3r 9y agoLets wait and see if a PC version of this exploit shows up considering the extensive use of PCIe on desktops.
- bitexploder 9y agoI have followed iOS JB for years and keep up with exploit dev and mitigation/defense. The usage of source code and avoiding deep assembly documenting helped a lot. You are still looking at several man days of deep work on understanding the driver and stack. KASLR was the only real mitigation to bypass. That could have been a difficult part worth it's own discussion. Bypassing ASLR typically requires an info leak. I think 3-4 weeks of one person's effort is a good guess. +/- 1wk depending.
- KGIII 9y agoIf others don't know, the K is for kernel. I had guessed that it was, but decided to look it up. I figure this may save others some time. It looks pretty neat, conceptually. It loads the kernel into a random location in memory on boot. I haven't looked into how random it is, but it's a good idea.
- rhexs 9y agoGoodness, it takes only several days to reverse engineer a driver and stack now? Wow. I know the project zero guys are good, but damn.
- PascLeRasc 9y agoIs the source for this code only Apple's open-source publishings?